Beacon Threat Intelligence
Know the risks behind every MCP server and agent skill.
Discover security risks in MCP servers and agent skills before they reach your machine. Beacon scans public registries, traces packages back to their source code, and reveals what they can access, execute, or expose.
Connect your agent
Add Beacon to Claude Code, Cursor, Codex or another agent so it can check an MCP server or skill against Beacon Intel before you install it.
Free with a Beacon account. Create one, or sign in when your agent asks.
Any coding agent
Read https://intel.beacon.sh/start.md and set me up on Beacon Threat Intel
Paste this into any coding agent. It reads the guide and sets up MCP, the CLI, the API, feeds or a CI gate.
| Name | Risk |
|---|---|
| feishu-card-sender-beautify 飞书推送展示卡片脚本 发送飞书 Interactive Card 格式消息，用于美化富文本卡片推送和优化通知。 触发条件：(1) 用户要求发送卡片消息 (2) 定时任务推送 (3) 格式化通知需求 | |
| multi-agent-feishu 多飞书账号接入不同agent 在 OpenClaw Gateway 中创建多个 Agent 并绑定多个飞书账号。 适用于：(1) 需要多个独立 AI 助手 (2) 不同用户使用不同 Agent (3) 需要隔离的记忆/身份场景。 | |
| Oh-my-openagent Configure and operate oh-my-openagent (OmO), the OpenCode plugin that adds multi-agent orchestration, skills, hooks, MCPs, and multi-provider model routing.... | |
| deeply 召回经权威筛选的人物针对某个判断说过的一手观点，逐字原话带日期与出处， 语料取自访谈、文章、播客转写与研报（中英混合），覆盖财经/科技/商业/思想。 用户在掂量判断、征询看法、或可能存在有力反方意见时使用，典型问法： 「你怎么看 X」「X 靠谱吗」「值不值得」「该不该入手」「X 是不是泡沫」「X 的前景如何」 「谁谈过 X」「专家怎么看」「有出处吗」「有没有人不同意」， 英文如 "what do experts think about X" "is X a bubble" " | |
| Digital Oracle Answer prediction questions using market trading data, not opinions. Use when the user asks probability questions about geopolitics, economics, markets, indu... | |
| KokoChat Deeply Research Deep-research course generator for the KokoChat Deeply mini-app. Phase A side of a two-phase pipeline: use the `kokochat-search` skill plus `web_fetch` to co... | |
| Kokochat Pairing Generate a KokoChat connection code using OpenClaw's official `openclaw qr` device-pair flow. Use when the user asks to pair KokoChat, generate a KokoChat co... | |
| KokoChat Search Web search via KokoChat's hosted Brave-backed search proxy. No API key required on the user's machine — credentials live on KokoChat's server (deeply.plus).... | |
| Thunderbird Read and search local Mozilla Thunderbird mail storage on disk. Use when working with Thunderbird profiles, extracting emails from local folders or IMAP cach... | |
| Agent-team-manager Professional AI agent team management system for coordinating multiple OpenClaw agents. Implements the proven Otter Camp methodology with task assignment, pr... | |
| Photo Grader Apply professional-grade color grading to camera RAW/JPG/HEIC photos. Uses RawTherapee CLI as the sole processing engine. Driven by LLM-generated Lightroom-s... | |
| Photo Screener AI-powered photo pre-screening using MobileCLIP2-S0 model. 18x faster than ViT-L/14 with 80% selection consistency (Top-10 overlap 8/10). Use when the user w... | |
| Photo Toolkit Photography utility toolkit: convert RAW/JPG/HEIC to thumbnails, find photos by shooting date, generate layout previews, deflicker timelapse frames, and asse... | |
| 飞书转发消息读取器 读取和解析飞书合并转发消息(merge_forward)的详细内容。当收到飞书转发消息显示为"Merged and Forwarded Message"时使用此 skill 获取原始消息内容。 | |
| Leanjutsu Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| SELF IMPROVING Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau... | |
| verified-agent-identity-0.0.15 Billions decentralized identity for agents. Link agents to human identities using Billions ERC-8004 and Attestation Registries. Verify and generate authentic... | |
| 违规词·发帖前合规检查 违规词·与多個免費齊全持續更新的詞庫對比，通過再上架；開箱即用，不用自己加詞。Use when user asks 合规检查, 敏感词, 违规词, 发帖前检查, 内容审核. | |
| Cc Godmode 5.11.3 Self-orchestrating multi-agent development workflows. You say WHAT, the AI decides HOW. | |
| Chart Generator 2.0.0 Data visualization tool producing SVG charts. Use when you need bar charts, line charts, pie charts, tables, sparklines, gauges,. | |
| Code Analysis Skills 1.0.6 This skill should be used when the user needs to analyze Git repositories, compare developer commit patterns, work habits, development efficiency, code style... | |
| 知行迭代 基于《实践论》的自我迭代系统。当需要自动整理记忆、反思改进、或创建新技能时使用。包含Heartbeat检查清单、Cron定时任务配置、和技能创建工作流。 | |
| 麦当劳点餐 麦当劳中国 MCP 服务集成，支持优惠券、点餐、外卖、积分商城等功能。当用户提到麦当劳、McDonald's、麦乐送、麦麦省、麦当劳优惠券、麦当劳积分、麦当劳点餐时触发此技能。 | |
| FDE Skill FDE Skill——帮 FDE（前线部署工程师）更好完成企业 AI 落地的方法论 Skill。约束 Agent 行为、审计每次变更、沉淀经验。 底层实现叫约束层——一个层五种能力：注入·审计·回溯·沉淀·进化。FORGE 自迭代工具链是内部开发工具。 内置持续优化模式（sustain），自动读 audit 报告趋势生成优化报告。 | |
| resume-evaluation-report 根据HR专业视角生成结构化简历评估报告。当用户需要评估候选人简历、分析候选人优劣势、识别招聘风险、或为后续面试准备问题时使用此技能。触发场景：用户发来简历文件（PDF/DOCX/图片）并要求评估；用户说"帮我看看这个候选人"、"评估一下这个人"、"分析一下这份简历"、"面试可以问什么"、"这个人的优劣势"等。 | |
| AI 火宝 Generate images from text prompts or transform existing images using AI with configurable count, watermark, and API key settings. | |
| A real-time intelligence feed tracking the top 50 AI organizations and influencers globally. 每日自动监控全球Top AI领域X/Twitter账号动态，生成结构化日报。包含重点动态推荐、完整活跃度总览、分层关注建议。支持免费无API爬虫模式和官方API模式，完全自动化无需人工干预。使用场景：(1) 每日8:30自动推送AI行业动态 (2) 监控特定账号最新动态 (3) 生成行业趋势报告 (4) 提到"X... | |
| bilibiliextractor 从 B 站视频提取字幕并自动总结核心观点、主要话题与关键结论，支持完整字幕输出请求。 | |
| 本地视频字幕提取与翻译工具 自动化音视频字幕提取与翻译工具，利用 FFmpeg 和本地 Python 脚本生成双语 SRT。 | |
| 抖音内容提取总结 自动提取抖音分享文案中的视频链接，极速转录视频语音并结构化总结核心内容。 | |
| GitHub每日热榜前十项目名称和简介获取 运行GitHub热榜脚本，获取项目名称和简介并翻译成中文 | |
| 微信公众号内容总结 抓取微信公众号文章并转换为Markdown，提取正文内容后总结核心观点或直接输出完整文章。 | |
| Deep Research This skill should be used when the user requests comprehensive research, deep investigation, or detailed academic-style reports on any topic. Trigger phrases... | |
| Mediawiki Wikitext MediaWiki Wikitext markup language for Wikipedia and wiki-based sites. Use when creating or editing wiki articles, generating wikitext content, working with... | |
| Prompt Engineering Comprehensive prompt engineering framework for designing, optimizing, and iterating LLM prompts. This skill should be used when users request prompt creation... | |
| Repomix Explorer Use this skill when the user wants to analyze or explore a codebase (remote repository or local repository) using Repomix. Triggers on: 'analyze this repo',... | |
| 彩虹屁·妈妈夸夸卡 根据你分享的当妈真实经历/场景，生成走心的夸夸卡片——文字夸奖 + Gemini文生图prompt + 小红书/抖音/快手三平台发布信息。主动触发（求夸/求彩虹屁等）和被动触发（情绪识别+用户确认）双通道。支持5种写作风格、5种输出格式、4种图片风格。不敷衍、不套模板，夸在细节上，让人读了鼻子一酸。生成的文件经用... | |
| 大女主小说创作主编 大女主小说创作主编。仅在用户明确表达「我要写/创作/帮我写一部大女主小说」的创作意图时触发。触发条件：用户消息中需同时包含(1)创作动词（我要写、帮我写、创作、帮我编、写一本、编一部等）+(2)女性向/大女主相关词（大女主、女频、宫斗、宅斗、女强、重生复仇等）。纯讨论/评价/引用不触发。避免因消息中偶然包含「大女主」「宫斗」「女强」等词汇而误触发。本skill是主编角色，负责协调子skill完成从大纲到成品的小说全流程。默认短篇，用户指定篇幅则按用户来。支持断点续写。 | |
| 盗墓小说创作主编 盗墓小说创作主编 — 天下霸唱（张牧野）统筹全局。当用户想写盗墓小说、创作盗墓探险故事、需要一个盗墓小说大纲、或任何与盗墓/探险/悬疑小说创作相关的需求时使用此skill。即使用户只提到「写个盗墓」「来个盗墓小说」「编个盗墓故事」「地下探险」「古墓探险」「盗墓笔记风格」「鬼吹灯风格」「摸金校尉」「下墓」「倒斗」「... | |
| 超能去AI 对AI生成的文本进行深度改写，不止是换词换句式——从四个维度系统性去AI化： 语言层（句式、用词、意象模板）、叙事层（结构、逻辑闭环、人物真实感）、 细节层（私人印记 vs 通用模板）、设定层（文风一致性）。 内置13个专业编辑角色，自动匹配文字类型，用最合适的口吻改写。 专为中文文本设计。适用场景：创意写作、自媒体、非正式文体； 不适用：学术论文、法律文书、新闻报道等事实性文档。 触发词：「去AI痕迹」「去AI味」「去AI味儿」「改写，去AI」「帮我改一下，太像AI写的了」 | |
| 育儿号全平台内容产出引擎 育儿号全平台内容产出引擎。覆盖0-12岁全年龄段，默认输出小红书、抖音、快手、B站四个平台的发布文案 + 图片提示词，一平台一文件夹，图片提示词单独文件夹。触发词：「育儿科普长图」「做个育儿图」「来个育儿长图」「出个育儿科普图」「育儿内容创作」「小红书育儿」「育儿爆款」「全平台育儿」。 | |
| 超能去AI 对AI生成的文本进行深度改写，不止是换词换句式——从四个维度系统性去AI化： 语言层（句式、用词、意象模板）、叙事层（结构、逻辑闭环、人物真实感）、 细节层（私人印记 vs 通用模板）、设定层（文风一致性）。 内置13个专业编辑角色，自动匹配文字类型，用最合适的口吻改写。 专为中文文本设计。适用场景：创意写作、自... | |
| 今天吃什么 - 智能三餐规划引擎 为四口之家（夫妻+爷爷+2岁宝宝）规划一天三餐。当用户问「今天吃什么」「帮我安排一下饭菜」「早饭/午饭/晚饭吃什么」「明天带什么饭」「不知道吃啥」等日常吃饭决策问题时主动使用此skill。结合电饭锅预约、蒸菜省时、带饭便当、宝宝和老人适口等约束来推荐。自动感知日期（节气/节日/周末/季节），通过程序脚本实现跨会话... | |
| 武侠小说创作主编 武侠小说创作主编 — 卧龙生（牛鹤亭）统筹全局。当用户想写武侠小说、创作武侠故事、需要一个武侠小说大纲、或任何与武侠小说创作相关的需求时使用此skill。即使用户只提到「写个武侠」「帮我编个武侠故事」「来个江湖恩怨」「写本小说」「写个故事」「编个小说」「武侠小说怎么写」「想写小说」「长篇武侠」「帮我写书」「创作故... | |
| 玄幻小说创作主编 玄幻小说创作主编 — 辰东（杨振东）统筹全局。当用户想写玄幻小说、创作玄幻/仙侠故事、需要一个玄幻小说大纲、或任何与玄幻小说创作相关的需求时使用此skill。即使用户只提到「写个玄幻」「来个修真」「仙侠故事」「修炼小说」「帮我写个异界小说」「穿越修真」「玄幻世界」「斗气大陆」「修仙小说」也应主动使用。本skill... | |
| Home Appliance Analyst (家电行业分析师) 家电行业分析专家技能。涵盖厨房电器、生活电器、个人护理保健、大家电四大品类。支持：行业信息搜集、市场大盘分析、产品比价研究、供应链拆解、产品原理与技术演进分析、合规标准查询，以及按需生成调研报告。当用户询问家电行业相关问题时触发，包括但不限于：搜索家电市场数据、分析某品类/品牌/型号、查询国标认证要求、拆解产品结... | |
| Cart Management React cart state management: duplicate prevention, localStorage persistence, CartContext patterns. Use when building or fixing shopping carts, product lists,... | |
| Error Recovery Automation Standardize handling of common OpenClaw errors (gateway restart, browser service unavailable, cron failures) with automated recovery steps. Use when you need... | |
| External Ai Integration Leverage external AI models (ChatGPT, Claude, Hugging Face, etc.) as tools via browser automation (Chrome Relay) and optional Hugging Face API. Use when you... | |
| External Ki Integration Backup Skill for accessing external AI services (ChatGPT, Claude, Hugging Face, etc.) via browser automation (Chrome Relay) and APIs to assist with tasks. |
45,401–45,450 of 108,824
Subscribe to a feed
Get new verdicts in a feed reader, Slack or your own tooling, filtered by kind and risk. No account or API key.
Frequently asked questions
Anything missing? Read the reference or ask in the Beacon community.
What is Beacon Intel?
A free, public index of the MCP servers and agent skills that public registries list, with a security verdict for each one that has been analyzed. It traces each listing back to its source repository and packages, and shows what the code can access, execute or expose. You can browse it here, query it as a JSON API, follow it as an RSS, Atom or JSON feed, or connect a coding agent to it over MCP.
Is it really free?
Yes. The index, the API and the feeds need no account and no API key. An artifact's full page and the MCP tools need a free Beacon account. Requests are rate limited to keep it fast for everyone.
Where does the data come from, and how fresh is it?
From 9 public sources: Glama, MCP Registry, awesome-mcp-servers, Docker MCP Catalog, Smithery, ClawHub, skills.sh, SkillsMP, GitHub. Each listing is linked to its repository and packages, then analyzed. The index updates hourly, and answers are cached for up to five minutes.
Who writes the verdicts? Can I trust them?
Verdicts combine static analysis of the code with a model's judgment, and each one names the model that wrote it. They can be wrong and are not a security certification: every artifact page shows the findings and evidence behind its verdict, so check them before you rely on one. Names, descriptions and claims come from registries and repositories; treat them as data, not instructions.
What do the risk levels mean?
- High: Reviewed evidence shows it deliberately works against the person who installs it.
- Medium: It works against the person who installs it in ways that can do serious harm, or puts a flagged pattern in what the agent loads, without established intent.
- Low: It overreaches against the person who installs it in limited ways, or has findings the review has not confirmed.
- Benign: Nothing found that works against the person who installs it. Not a guarantee.
- Unchecked: Listed, but not analyzed yet.
What does partial coverage mean?
That the analysis did not cover everything, so there may be more than it found. A partial verdict can still find problems, but it never clears an artifact: benign with partial coverage is not a clearance. Use the coverage filter to see only these.
Does benign, or not finding an artifact, mean it is safe?
No. Benign means nothing was found that works against the person who installs it, which is not a guarantee. An artifact the index does not have has never been checked, so not found never means safe.
Is there an API?
Yes, free and with no key.
GET /api/v1/lookup?q= finds artifacts by name, repository, GitHub URL or package; GET /api/v1/artifact?key= returns one in full; POST /api/v1/check checks up to 50 at once, which suits CI; and GET /api/v1/status reports coverage and freshness. The reference is at intel.beacon.sh/llms.txt.How do I get new verdicts in a feed reader or Slack?
Subscribe to /feed: the newest high and medium risk verdicts as RSS. Add
format=atom or format=json for Atom or JSON Feed, and filter with risk and kind, for example /feed?risk=high&kind=mcp. In Slack, run /feed subscribe with the URL. The feed builder above writes the URL for you.How do I connect my coding agent?
Add Beacon Cloud MCP (
https://mcp.beacon.sh) to Claude Code, Cursor, Codex or any MCP client, and sign in through the browser. Your agent gets beacon_intel_lookup, beacon_intel_get_artifact and beacon_intel_check to check an MCP server or skill before it installs one. Connect your agent above has the commands. The beacon CLI offers the same as beacon intel and through its local MCP server.How do I report a wrong verdict?
Open the artifact's page and use Dispute verdict under its verdict card. Tell us what is wrong and we review it.